airflow.providers.keycloak.auth_manager.services.token¶
Functions¶
|
|
|
Create token using OAuth2 client_credentials grant type. |
Module Contents¶
- airflow.providers.keycloak.auth_manager.services.token.create_token_for(username, password, expiration_time_in_seconds=conf.getint('api_auth', 'jwt_expiration_time'))[source]¶
- airflow.providers.keycloak.auth_manager.services.token.create_client_credentials_token(client_id, client_secret, expiration_time_in_seconds=conf.getint('api_auth', 'jwt_expiration_time'))[source]¶
Create token using OAuth2 client_credentials grant type.
This authentication flow uses the provided client_id and client_secret to obtain a token for a service account. The Keycloak client must have: - Service accounts roles: ON - Client Authentication: ON (confidential client)
The service account must be configured with the appropriate roles/permissions.
Only the client Airflow is configured to use is accepted. The route this is reached from is unauthenticated, so without that restriction the credentials of any confidential client in the realm would be usable to obtain an Airflow token.